Privacy notice

• Your account: your household name, email address (and whether you’ve confirmed it) and password (stored only as a secure hash), and your sensor API key.
• Your pantry: the foods you keep, amounts, purchase and expiry details, recipes, meal plans, shopping lists and orders.
• Your sensors: each jar’s readings (level, battery, temperature), its settings and your gateway’s status.
• Voice and AI: what jars announce is kept for a day; when you use the AI assistant, how much it was used (not what was said) is kept for the monthly limit.
• Preferences: preferred stores, ordering and notification settings, and an optional phone number for notifications.

Only to run Larder for you: tracking your pantry, planning meals, building shopping lists, and keeping your sensors and gateway working. We don’t sell your information or use it for advertising.

Larder runs on a server we rent in a data centre in Sydney, Australia. Your information is stored there, and in encrypted backups kept with a second provider.

A few services do one job each for us, and only get what that job needs:

• Resend sends Larder’s emails (confirming your address, resetting your password): it receives your email address and the email’s text.
• Cloudflare runs our domain’s DNS and forwards emails you send to support@cookiejardigital.com to us.
• Anthropic (Claude), only if your household switches the AI assistant on: the request and the food and jar names it needs, not your name or email.
• Woolworths, Coles and Harris Farm (product prices on the Shopping List) and TheMealDB (recipe ideas) receive only the food or recipe being searched for, never who is searching.

Some of these are overseas companies, so the information they handle may be processed outside Australia. None of them may use it for anything else.

Your household account sees your household’s information. No other household can: the database itself only gives each household its own rows.

A small number of Larder staff run the service, from a separate staff site on a private network. Staff have their own accounts, signed in with a password and a code from an authenticator app. Their access is limited by role (viewer, operator, support, owner), and every action they take is recorded:

• Staff screens show your household by a reference number, not your name or email.
• To see your name and email (for example to answer a support request), a support staff member must give a reason. The view lasts 30 minutes, and it is recorded.
• Commands sent to your gateway or jars by staff (for example to restart the gateway) are recorded.

You can see these records about your household on Profile & Preferences > Support access: when, what, the staff member’s role and the reason given.

• Your account, pantry, recipes and plans are kept while your account is open.
• Each jar’s individual readings are kept for 90 days; after that, hourly averages (level, temperature, battery) are kept while your account is open.
• Email links (confirming your address, resetting your password) work for 24 hours or one hour, and are deleted 30 days after they expire.
• Jar announcements: one day. The live view of sensor and gateway messages keeps the most recent 2,000 messages across all households.
• Message log files are only written when staff switch logging on to diagnose a fault, and are deleted after 14 days.
• Records of staff access are kept for two years; you can see the ones about you at any time.

Passwords are hashed, the website is only served over an encrypted connection (HTTPS), and your gateway connects to Larder over an encrypted link with its own login, which can only reach your household’s messages. The staff site is not on the public internet. Staff access needs an admin role, and staff actions are recorded. Backups are encrypted.

You can view and correct your information in the app (including your email address), regenerate your API key, switch the AI assistant off, and ask us at support@cookiejardigital.com for a copy of your information or to delete your account and its information. If you think your information has been mishandled, contact us and we’ll respond; you can also contact the Office of the Australian Information Commissioner.